{"id":70,"date":"2022-07-17T22:08:02","date_gmt":"2022-07-17T22:08:02","guid":{"rendered":"http:\/\/moveax.me\/?p=70"},"modified":"2022-08-31T19:01:14","modified_gmt":"2022-08-31T19:01:14","slug":"nebula-level19-a-newbies-approach","status":"publish","type":"post","link":"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level19-a-newbies-approach\/","title":{"rendered":"Nebula Level19: A Newbie\u2019s Approach"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">We reached the last challenge of Nebula exercises, level19. This challenge deals with the basic way on how processes work on Linux systems.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>What you\u2019ll need to know\u2026<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li>Processes on Unix<\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Level19<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Looking at the code on the&nbsp;<a href=\"https:\/\/exploit-exercises.com\/nebula\/level19\/\">main page<\/a>&nbsp;of level19, we quickly see something interesting, the execution of a shell.<br>The problem is the shell will only run if the user root started the program flag19. If we were root and ran the program, we would have a shell under the flag19 account. But we are not root or have the ability to become root. Or do we?<br>Quick aside note: in Linux every process has a parent. When the system fires up,&nbsp;<code>init<\/code>&nbsp;is created by the kernel and all the processes are their children (or grandchildren and so forth and so on). Now, if we start a process (parent) that also starts a process (children) and for some reason the parent dies before the children, then it becomes orphan. In this case,&nbsp;<code>init<\/code>&nbsp;will kind of \u201cadopt\u201d this orphan. Can you see why this is useful?<br>We can apply all this theory so we can solve this last challenge. We create a program that starts flag19, but that program needs to die before the execution of flag19 arrives at line 28.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To solve the challenge, I\u2019ll use my SUID program.<\/p>\n\n\n\n<figure class=\"wp-block-image\" id=\"attachment_831\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/07\/SUID.png\" alt=\"SUID\" class=\"wp-image-831\"\/><figcaption>Remember this code?<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">I\u2019ll also write the program that will call flag19 and pass to it the commands to compile my SUID program.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/07\/level19c.png\" alt=\"level19.c\" class=\"wp-image-832\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Now, it\u2019s just a matter of compiling this C program with&nbsp;<code>gcc -o level19 level19.c<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Run the executable file produced by the last command and you\u2019ll see a new one under the&nbsp;<code>\/home\/flag19<\/code>&nbsp;directory.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/07\/files-1.png\" alt=\"Files\" class=\"wp-image-833\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">And now, like&nbsp;<a href=\"nebula-level11\/\">previous challenges<\/a>, it\u2019s just a matter of running the moveaxme executable and collect the flag.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter\"><img decoding=\"async\" src=\"wp-content\/uploads\/2018\/07\/result_level19.png\" alt=\"Result level19\" class=\"wp-image-834\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">All Nebula challenges have been solved!!!<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Challenges completed: 20\/20<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Mitigation<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">I\u2019ll wait for suggestions for this one!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Walkthrough<\/strong><\/h2>\n\n\n\n<figure class=\"wp-block-embed\"><div class=\"wp-block-embed__wrapper\">\nhttps:\/\/www.youtube.com\/watch?v=tC7e9jySIk4=06m57s\n<\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Further Reading<\/strong><\/h2>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/www.ibm.com\/developerworks\/community\/blogs\/58e72888-6340-46ac-b488-d31aa4058e9c\/entry\/an_overview_of_linux_processes21?lang=en\">An overview of Linux processes<\/a><\/li><\/ul>\n","protected":false},"excerpt":{"rendered":"<p>We reached the last challenge of Nebula exercises, level19. This challenge deals with the basic way on how processes work on Linux systems. What you\u2019ll&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/giga-rapid.com\/esites\/moveaxme\/nebula-level19-a-newbies-approach\/\">Continue reading<span class=\"screen-reader-text\">Nebula Level19: A Newbie\u2019s Approach<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4,1],"tags":[],"class_list":["post-70","post","type-post","status-publish","format-standard","hentry","category-nebula","category-uncategorized","entry"],"_links":{"self":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/70","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/comments?post=70"}],"version-history":[{"count":2,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/70\/revisions"}],"predecessor-version":[{"id":108,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/posts\/70\/revisions\/108"}],"wp:attachment":[{"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/media?parent=70"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/categories?post=70"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/giga-rapid.com\/esites\/moveaxme\/wp-json\/wp\/v2\/tags?post=70"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}